cms_scanner 0.12.2 → 0.13.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 943549919eeec0dc993e93789c543064401359f1673b030e7520ac49eddd8b67
-  data.tar.gz: db1524123914c10872586742d1b52bb50550391c5b6b2c56ceaae541b9ff27ad
+  metadata.gz: 23e6eef37dbbfd36110bddad6591acf10944b131eb693bbdef24ef52d9a597b1
+  data.tar.gz: 4857f7c2489169d3e25f813a4df6a7389e6dea566299e35ea37be35007770e49
 SHA512:
-  metadata.gz: a70bd9df89f08639549c44c5611bcd1cdab4712d85e02cd2a9b2fe37cb31ab61fe5bb407464686b8abd1a68f7b3986675b17ffe287a967acbe536a6153f5a5c9
-  data.tar.gz: 48e01f3d443bd2b78e0ad4fd5e63c8d80ecc4c3bbc40886b5355d4d604a14d985734d90ed3707a22addf7b45fd8c8bcee8e00898bbe4caf7e3fe2cc0025f4093
+  metadata.gz: da8668532581efc8ba6db9e8ef941573674c972319846c65cf2ed6ad2d3f63ef72f9a474385e0050cd7e47468fae9edabb3fbb49a5670975927efbbd9c1dad15
+  data.tar.gz: 5e28da01a72d5ae5478040dd47202001fb1849e25080ebac690a23ca20b692c40957b1218588fe15407483e5f4a7e29e2c153a7454cf79b0c165a269d8d694c5

data/app/controllers/core.rb

@@ -43,7 +43,7 @@ module CMSScanner
         when 401
           raise Error::HTTPAuthRequired
         when 403
-          raise Error::AccessForbidden, NS::ParsedCli.random_user_agent
+          raise Error::AccessForbidden, NS::ParsedCli.random_user_agent unless NS::ParsedCli.force
         when 407
           raise Error::ProxyAuthRequired
         end

data/app/controllers/core/cli_options.rb

@@ -10,7 +10,8 @@ module CMSScanner
         [
           OptURL.new(['-u', '--url URL', 'The URL to scan'],
                      required_unless: %i[help hh version],
-                     default_protocol: 'http')
+                     default_protocol: 'http'),
+          OptBoolean.new(['--force', 'Do not check if target returns a 403'])
         ] + mixed_cli_options + [
           OptFilePath.new(['-o', '--output FILE', 'Output to FILE'], writable: true, exists: false),
           OptChoice.new(['-f', '--format FORMAT',

data/app/views/json/scan_aborted.erb

@@ -1,4 +1,5 @@
 "scan_aborted": <%= @reason.to_json %>,
+"target_url": <%= @url.to_json %>,
 <% if @verbose -%>
 "trace": <%= @trace.to_json %>,
 <% end %>

data/lib/cms_scanner/errors/http.rb

@@ -44,7 +44,7 @@ module CMSScanner
 
       def to_s
         msg = if random_user_agent_used
-                'Well... --random-user-agent didn\'t work, you\'re on your own now!'
+                'Well... --random-user-agent didn\'t work, use --force to skip this check if needed.'
               else
                 'Please re-try with --random-user-agent'
               end

data/lib/cms_scanner/finders/finder/enumerator.rb

@@ -59,6 +59,8 @@ module CMSScanner
 
           full_res = NS::Browser.get(head_res.effective_url, full_request_params)
 
+          return unless valid_response_codes.include?(full_res.code)
+
           return if target.homepage_or_404?(full_res) ||
                     opts[:exclude_content] && full_res.body&.match(opts[:exclude_content])
 

data/lib/cms_scanner/references.rb

@@ -86,7 +86,7 @@ module CMSScanner
 
     # @return [ String ] The URL to the metasploit module page
     def msf_url(mod)
-      "https://www.rapid7.com/db/modules/#{mod.sub(%r{^/}, '')}"
+      "https://www.rapid7.com/db/modules/#{mod.sub(%r{^/}, '')}/"
     end
 
     # @return [ Array<String> ] The Packetstormsecurity IDs

data/lib/cms_scanner/scan.rb

@@ -29,11 +29,15 @@ module CMSScanner
     rescue NoMemoryError, ScriptError, SecurityError, SignalException, StandardError, SystemStackError => e
       @run_error = e
 
-      formatter.output('@scan_aborted',
-                       reason: e.is_a?(Interrupt) ? 'Canceled by User' : e.message,
-                       trace: e.backtrace,
-                       verbose: NS::ParsedCli.verbose ||
-                                run_error_exit_code == NS::ExitCode::EXCEPTION)
+      output_params = {
+        reason: e.is_a?(Interrupt) ? 'Canceled by User' : e.message,
+        trace: e.backtrace,
+        verbose: NS::ParsedCli.verbose || run_error_exit_code == NS::ExitCode::EXCEPTION
+      }
+
+      output_params[:url] = controllers.first.target.url if NS::ParsedCli.url
+
+      formatter.output('@scan_aborted', output_params)
     ensure
       formatter.beautify
     end

data/lib/cms_scanner/target/server/generic.rb

@@ -41,7 +41,7 @@ module CMSScanner
         def directory_listing?(path = nil, params = {})
           res = NS::Browser.get(url(path), params)
 
-          res.code == 200 && res.body.include?('<h1>Index of') ? true : false
+          res.code == 200 && res.body.include?('<h1>Index of')
         end
 
         # @param [ String ] path

data/lib/cms_scanner/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module CMSScanner
-  VERSION = '0.12.2'
+  VERSION = '0.13.4'
 end

data/lib/cms_scanner/vulnerability.rb

@@ -5,7 +5,7 @@ module CMSScanner
   class Vulnerability
     include References
 
-    attr_reader :title, :type, :fixed_in, :cvss
+    attr_reader :title, :type, :fixed_in, :introduced_in, :cvss
 
     # @param [ String ] title
     # @param [ Hash ] references
@@ -18,14 +18,16 @@ module CMSScanner
     # @option references [ Array<String> ] :youtube
     # @param [ String ] type
     # @param [ String ] fixed_in
+    # @param [ String ] introduced_in
     # @param [ HashSymbol ] cvss
     # @option cvss [ String ] :score
     # @option cvss [ String ] :vector
-    def initialize(title, references: {}, type: nil, fixed_in: nil, cvss: nil)
-      @title    = title
-      @type     = type
-      @fixed_in = fixed_in
-      @cvss     = { score: cvss[:score], vector: cvss[:vector] } if cvss
+    def initialize(title, references: {}, type: nil, fixed_in: nil, introduced_in: nil, cvss: nil)
+      @title         = title
+      @type          = type
+      @fixed_in      = fixed_in
+      @introduced_in = introduced_in
+      @cvss          = { score: cvss[:score], vector: cvss[:vector] } if cvss
 
       self.references = references
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cms_scanner
 version: !ruby/object:Gem::Version
-  version: 0.12.2
+  version: 0.13.4
 platform: ruby
 authors:
 - WPScanTeam
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-01-04 00:00:00.000000000 Z
+date: 2021-04-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: get_process_mem
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.3
+        version: 1.9.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.3
+        version: 1.9.4
 - !ruby/object:Gem::Dependency
   name: public_suffix
   requirement: !ruby/object:Gem::Requirement
@@ -106,6 +106,20 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '1.5'
+- !ruby/object:Gem::Dependency
+  name: ethon
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.14.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.14.0
 - !ruby/object:Gem::Dependency
   name: xmlrpc
   requirement: !ruby/object:Gem::Requirement
@@ -210,28 +224,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.7.0
+        version: 1.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.7.0
+        version: 1.13.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.0
+        version: 1.11.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.0
+        version: 1.11.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -266,17 +280,17 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.11.0
+        version: 3.12.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.11.0
+        version: 3.12.0
 description: Framework to provide an easy way to implement CMS Scanners
 email:
-- team@wpscan.org
+- contact@wpscan.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -393,7 +407,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.0.3.1
 signing_key: 
 specification_version: 4
 summary: CMS Scanner Framework (experimental)